CVE-2004-2185

Multiple cross-site scripting XSS vulnerabilities in MediaWiki 1.3.5 allow remote attackers to execute arbitrary scripts and/or SQL queries via 1 the UnicodeConverter extension, 2 raw page views, 3 SpecialIpblocklist, 4 SpecialEmailuser, 5 SpecialMaintenance, and 6 ImagePage...

CVE-2009-4953

Cross-site scripting XSS vulnerability in the Userdata Create/Edit sguserdata extension before 0.91.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-4952

Directory traversal vulnerability in the Directory Listing dirlisting extension 1.1.0 and earlier for TYPO3 allows remote attackers to have an unspecified impact via unknown vectors...

CVE-2009-4711

SQL injection vulnerability in the CoolURI cooluri extension before 1.0.16 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2008-6686...

CVE-2009-4709

SQL injection vulnerability in the datamints Newsticker datamintsnewsticker extension before 0.7.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2009-4702

SQL injection vulnerability in the Tour Extension pmtour extension before 0.0.13 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2002-1718

Microsoft Internet Information Server IIS 5.1 may allow remote attackers to view the contents of a Frontpage Server Extension FPSE file, as claimed using an HTTP request for colegal.htm that contains .. dot dot sequences...

CVE-2009-4394

SQL injection vulnerability in the Random Prayer 2 steprayer2 extension 0.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2009-1264

Frontend User Registration srfeuserregister extension 2.5.20 and earlier for TYPO3 does not properly verify access rights, which allows remote authenticated users to obtain sensitive information such as passwords via unknown attack vectors...

GHSA-QFM8-78QF-P75J The Front End User Registration extension for TYPO3 (sr_feuser_register) Remote Code Execution

The srfeuserregister extension through 12.4.8 for TYPO3 allows Remote Code Execution via unsafe deserialization...

Deserialization of Untrusted Data

Overview sjbr/sr-feuser-register is an A self-registration variant of Kasper Skårhøj's Front End User Admin extension for TYPO3 CMS. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via an unsafe uploaded file without proper validation. An attacker can execute...

CVE-2009-3820

SQL injection vulnerability in the Flagbit Filebase fbfilebase extension 0.1.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2009-3819

Unspecified vulnerability in the Random Images maagrandomimage extension 1.6.4 and earlier for TYPO3 allows remote attackers to execute arbitrary shell commands via unspecified vectors...

GHSA-HQ4F-5QJV-FWRG The Backup Plus extension for TYPO3 (ns_backup) has a Predictable Resource Location

The nsbackup extension through 13.0.0 for TYPO3 has a Predictable Resource Location. This allows an unauthenticated remote user to download created backups and configuration files...

The Backup Plus extension for TYPO3 (ns_backup) has a Predictable Resource Location

The nsbackup extension through 13.0.0 for TYPO3 has a Predictable Resource Location. This allows an unauthenticated remote user to download created backups and configuration files...

CVE-2025-45752

A vulnerability in SeedDMS 6.0.32 allows an attacker with admin privileges to execute arbitrary PHP code by exploiting the zip import functionality in the Extension Manager...

Command Injection

Overview nitsan/ns-backup is an extension for TYPO3 that lets you save your code, files, and database with just a few clicks. Install Backup Plus and connect it to your cloud storage like Google Drive, Dropbox, Amazon S3, SFTP, Rsync, etc.. Affected versions of this package are vulnerable to...

GHSA-XG53-MHH9-3CQ7 The Backup Plus extension for TYPO3 (ns_backup) allows XSS

The nsbackup extension through 13.0.0 for TYPO3 allows XSS...

The Front End User Registration extension for TYPO3 (sr_feuser_register) allows Insecure Direct Object Reference

The srfeuserregister extension through 12.4.8 for TYPO3 allows Insecure Direct Object Reference. This allows attackers to read arbitrary files...

The Backup Plus extension for TYPO3 (ns_backup) allows XSS

The nsbackup extension through 13.0.0 for TYPO3 allows XSS...